PCSE Practice Question: Managing Operations in a Cloud Solution Environment
A security engineer needs to ensure that all container images deployed to a GKE cluster are signed by a trusted authority. The organization uses Cloud KMS for key management and wants to enforce the policy at admission time. Which two components are essential to implement this requirement? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attestor created in Binary Authorization with Cloud KMS key
Binary Authorization requires attestors to verify image signatures and a policy that requires at least one attestation. Attestors use Cloud KMS keys for signing, and the policy is enforced at GKE admission time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Audit Logs enabled for GKE
Why it's wrong here
Audit logs are for monitoring, not enforcing image signing.
- ✗
Container Analysis vulnerability scanning
Why it's wrong here
Vulnerability scanning is not part of the signing enforcement; it's a separate security control.
- ✓
Attestor created in Binary Authorization with Cloud KMS key
Why this is correct
Attestors are used to verify signatures; Cloud KMS keys provide cryptographic signing.
- ✓
Binary Authorization policy set to 'Require Attestation'
Why this is correct
This policy type enforces that only signed images can be deployed.
- ✗
Web Security Scanner configured to scan the GKE cluster
Why it's wrong here
Web Security Scanner is for finding web vulnerabilities, not for image signing enforcement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.